Potdf-Bl4Ck-570Rm

**Name of the Vulnerable Software and Affected Versions** appwrite/templates (affected versions not specified) **Description** The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The `verifyWebhook()` function in `node/github-issue-bot/src/github.js` and `node-typescript/github-issue-bot/src/github.ts` uses an inverted condition that returns true if the `X-Hub-Signature-256` header is missing. This allows unauthenticated requests without a signature to bypass HMAC verification. Consequently, the `postComment()` function can be triggered using data from the request body, enabling an attacker to use the configured `GITHUB TOKEN` to post comments on arbitrary repositories and issues by manipulating the repository and issue objects, as well as the issue author login. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.